Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Malicious release: Malicious code in voicekit (PyPI) MAL-2026-18175 | Malicious | Not scored | 8 days ago | PyPI voicekit |
Malicious release: Malicious code in ttsweaver (PyPI) MAL-2026-18172 | Malicious | Not scored | 8 days ago | PyPI ttsweaver |
Malicious release: Malicious code in ttsprobe (PyPI) MAL-2026-18171 | Malicious | Not scored | 8 days ago | PyPI ttsprobe |
Malicious release: Malicious code in ttsdock (PyPI) MAL-2026-18169 | Malicious | Not scored | 8 days ago | PyPI ttsdock |
Malicious release: Malicious code in voxweaver (PyPI) MAL-2026-18176 | Malicious | Not scored | 8 days ago | PyPI voxweaver |
Malicious release: Malicious code in speaksocket (PyPI) MAL-2026-18167 | Malicious | Not scored | 8 days ago | PyPI speaksocket |
Malicious release: Malicious code in asrdock (PyPI) MAL-2026-18156 | Malicious | Not scored | 8 days ago | PyPI asrdock |
Malicious release: Malicious code in pipegrip (PyPI) MAL-2026-18154 | Malicious | Not scored | 8 days ago | PyPI pipegrip |
Malicious release: Malicious code in hookgantry (PyPI) MAL-2026-18153 | Malicious | Not scored | 8 days ago | PyPI hookgantry |
Malicious release: Malicious code in acousticpack (PyPI) MAL-2026-18152 | Malicious | Not scored | 8 days ago | PyPI acousticpack |
Malicious release: Malicious code in dictanovaasr (PyPI) MAL-2026-18139 | Malicious | Not scored | 8 days ago | PyPI dictanovaasr |
Malicious release: Malicious code in orchestril (PyPI) MAL-2026-18142 | Malicious | Not scored | 8 days ago | PyPI orchestril |
Malicious release: Malicious code in prosodinetts (PyPI) MAL-2026-18144 | Malicious | Not scored | 8 days ago | PyPI prosodinetts |
Malicious release: Malicious code in codecraze (PyPI) MAL-2026-18137 | Malicious | Not scored | 8 days ago | PyPI codecraze |
Malicious release: Malicious code in solivoxtts (PyPI) MAL-2026-18147 | Malicious | Not scored | 8 days ago | PyPI solivoxtts |
Malicious release: Malicious code in tessivatts (PyPI) MAL-2026-18148 | Malicious | Not scored | 8 days ago | PyPI tessivatts |
Malicious release: Malicious code in vellutts (PyPI) MAL-2026-18149 | Malicious | Not scored | 8 days ago | PyPI vellutts |
Malicious release: Malicious code in grommatts (PyPI) MAL-2026-18140 | Malicious | Not scored | 8 days ago | PyPI grommatts |
Malicious release: Malicious code in zennittts (PyPI) MAL-2026-18151 | Malicious | Not scored | 8 days ago | PyPI zennittts |
Malicious release: Malicious code in aurenatts (PyPI) MAL-2026-18134 | Malicious | Not scored | 8 days ago | PyPI aurenatts |
Malicious release: Malicious code in phonoviatts (PyPI) MAL-2026-18143 | Malicious | Not scored | 8 days ago | PyPI phonoviatts |
Malicious release: Malicious code in voxilaratts (PyPI) MAL-2026-18150 | Malicious | Not scored | 8 days ago | PyPI voxilaratts |
Malicious release: Malicious code in brummatts (PyPI) MAL-2026-18136 | Malicious | Not scored | 8 days ago | PyPI brummatts |
Malicious release: Malicious code in melcuratts (PyPI) MAL-2026-18141 | Malicious | Not scored | 8 days ago | PyPI melcuratts |
Malicious release: Malicious code in quillonatts (PyPI) MAL-2026-18145 | Malicious | Not scored | 8 days ago | PyPI quillonatts |
Malicious release: Malicious code in shellgrip (PyPI) MAL-2026-18146 | Malicious | Not scored | 8 days ago | PyPI shellgrip |
Malicious release: Malicious code in batchspar (PyPI) MAL-2026-18135 | Malicious | Not scored | 8 days ago | PyPI batchspar |
Malicious release: Malicious code in crenelatts (PyPI) MAL-2026-18138 | Malicious | Not scored | 8 days ago | PyPI crenelatts |
Malicious release: Malicious code in journey-test-hellospy (PyPI) MAL-2026-18133 | Malicious | Not scored | 8 days ago | PyPI journey-test-hellospy |
Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1 BIT-pillow-2026-114501, CVE-2026-114501, GHSA-654x-cwwv-5j9c, PYSEC-2026-4336 | Medium | 0.4% | 8 days ago | PyPI Pillow PyPI pillow |
Malicious release: Malicious code in libseal (PyPI) MAL-2026-18132 | Malicious | Not scored | 8 days ago | PyPI libseal |
Malicious release: Malicious code in iterquarry (PyPI) MAL-2026-18131 | Malicious | Not scored | 8 days ago | PyPI iterquarry |
Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags CVE-2026-112902, GHSA-xvh5-g6gv-559v | High | Not scored | 8 days ago | PyPI Pillow PyPI pillow |
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer BIT-pillow-2026-96778, CVE-2026-96778, GHSA-g7cr-3p24-7wf7 | High | 0.5% | 8 days ago | PyPI Pillow PyPI pillow |
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds) BIT-pillow-2026-96644, CVE-2026-96644, GHSA-9v9v-9qvf-h2hj, PYSEC-2026-4343 | High | 0.4% | 8 days ago | PyPI Pillow PyPI pillow |
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time BIT-pillow-2026-96643, CVE-2026-96643, GHSA-g4qv-2jxx-769h, PYSEC-2026-4342 | High | 0.4% | 8 days ago | PyPI Pillow PyPI pillow |
Pillow: TarIO negative size field causes infinite CPU-spin loop BIT-pillow-2026-96642, CVE-2026-96642, GHSA-3j72-p6qg-6xp7, PYSEC-2026-4341 | High | 0.3% | 8 days ago | PyPI Pillow PyPI pillow |
Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise BIT-pillow-2026-96641, CVE-2026-96641, GHSA-4rm8-3hmm-39fg, PYSEC-2026-4340 | Medium | 0.3% | 8 days ago | PyPI pillow |
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion BIT-pillow-2026-96640, CVE-2026-96640, GHSA-mrfp-p49p-3hf2 | High | 0.6% | 8 days ago | PyPI Pillow PyPI pillow |
Pillow multi-frame loaders can reuse stale native image storage after mode transitions BIT-pillow-2026-96639, CVE-2026-96639, GHSA-v9pv-5gc8-w2m6, PYSEC-2026-4339 | Critical | 0.7% | 8 days ago | PyPI Pillow PyPI pillow |
Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode BIT-pillow-2026-96638, CVE-2026-96638, GHSA-24rc-8hj2-v98c | Medium | 0.3% | 8 days ago | PyPI pillow |
Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS BIT-pillow-2026-96637, CVE-2026-96637, GHSA-g842-9rc4-69pw, PYSEC-2026-4338 | High | 0.4% | 8 days ago | PyPI pillow |
Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek) BIT-pillow-2026-96636, CVE-2026-96636, GHSA-p8hx-v2p6-rp84, PYSEC-2026-4337 | Medium | 0.3% | 8 days ago | PyPI Pillow PyPI pillow |
GitPython validates a submodule's ".git" path only after cloning into it (RCE) CVE-2026-114145, GHSA-83vg-56qc-22m7 | High | 0.4% | 8 days ago | PyPI Gitpython PyPI gitpython |
nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc CVE-2026-114140, GHSA-pjvx-prjx-h659 | High | 0.4% | 8 days ago | PyPI nbconvert |
Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation CVE-2026-114138, GHSA-33wh-fxxf-88vv | High | 0.6% | 8 days ago | PyPI djangorestframework |
Django REST framework: TokenProxy.delete() reports success and revokes nothing CVE-2026-114137, GHSA-xw6w-gcfp-cf8m | High | 0.5% | 8 days ago | PyPI djangorestframework |
Django REST framework: JSONParser applies an attacker-named codec to the request stream CVE-2026-114136, GHSA-3547-9m27-7rxg | High | 0.4% | 8 days ago | PyPI djangorestframework |
Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization CVE-2026-114135, GHSA-354v-3q48-cv69 | High | 0.5% | 8 days ago | PyPI jupyter-server |
Malicious release: Malicious code in journey-test-helloshell (PyPI) MAL-2026-18124 | Malicious | Not scored | 8 days ago | PyPI journey-test-helloshell |